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Remarks 

I. Introduction 

This is in response to the Office Action dated September 21 , 2005. The 
Office Action rejected claims 1-8, 10-20, and 22-24 under 35 U.S.C. §103(a) as 
being unpatentable over U.S. Patent No. 5,787,253 to McCreery et al. 
(McCreery) in view of U.S. Patent No. 6,748,431 to Fleig et al. (Fleig). 

Claims 1 and 13 have been amended. Claims 9 and 21 have previously 
been canceled. Claims 1-8, 10-20, and 22-24 remain for consideration. 

II. Rejections under 35 U.S.C. §103 

Claims 1-8, 10-20, and 22-24 were rejected under 35 U.S.C. §1 03(a) as 
being unpatentable over McCreery in view of Fleig. Neither of the cited 
references, either alone or in combination, disclose Applicant's invention. 

The present invention is generally directed to a method and system for 
monitoring traffic in a network. A network interface has a run-time system, or first 
module, and one or more programmable processing modules executing on the 
network interface. The run-time system module feeds information derived from a 
network packet to the processing modules which process the information and 
generate output, such as condensed statistics, about the packets traveling 
through the network. The same processing module may be used and reused, 
with different parameters passed to the module. 

McCreery is directed to an internet activity analyzer that includes a 
network interface controller, a packet capturing module, a packet analysis 
module, and a data management module. The network interface controller is 
connected to a transmission medium for a network segment and is arranged to 
receive the stream of data packets passing along the medium. (Abstract). The 
packet analysis section receives the buffered packet data and decodes certain 
information in the packets to provide information such as the sources and 
destinations of the packets. (Col. 4, lines 63-66). The internet activity analyzer 
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includes a central processing unit (CPU) and an input device. The CPU provides 
signals for processing the packets based on user input. (Col. 7, lines 7-15). 

Fleig is directed to systems and methods for monitoring exchanges 
between a client and a server across a network. More specifically, Fleig relates 
to systems and methods that "read a network monitor trace and rebuild the 
requests and responses to make the exchanges easily readable to a user by 
rebuilding entire requests and responses, coalescing chunked information, 
collecting interleaved packets, reformatting XML bodies if present, and optionally 
removing any HTML bodies from the requests and responses." (Col. 2, lines 11- 
21). 

Independent claim 1 is directed to a method for monitoring traffic in a 
network. Claim 1 contains the limitation of: 

wherein the first module passes parameters to the at least 
one programmable processing module, thereby changing the 
processing performed by the at least one programmable 
processing module. 

As the Office Action admits, McCreery does not disclose that a first 
module can pass parameters to a programmable processing module in order to 
change the processing performed by the programmable processing module. The 
Office Action relies on Fleig as disclosing this limitation. 

Fleig, however, does not disclose that a first module can pass parameters 
to a programmable processing module in order to change the processing 
performed by the programmable processing module. Fleig discloses gathering 
packets into a network monitor trace, identifying the source and destination of 
each packet, and distributing the packets to variable locations for storage. Col. 
6, lines 35-42. 

The Office Action states that the claim limitation of a first module being 
able to pass parameters to a programmable processing module in order to 
change the processing performed by the programmable processing module is 
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shown by Fleig in col. 3, lines 62-67 and col. 4, lines 1-10. These passages state 
that program modules executed by Fleig's computers "include routines, 
programs, objects, components, data structures, etc. that perform particular tasks 
or implement particular abstract data types. Computer-executable instructions, 
associated data structures, and program modules represent examples of the 
program code means for executing steps" of Fleig's methods. Fleig does not, 
however, disclose passing parameters to a programmable processing module in 
order to change the processing performed by the programmable processing 
module, as claimed in claim 1. The cited passages only disclose that Fleig's 
computers execute programs, routines, objects, etc. 

Similar to claim 1, amended independent claim 13 contains the limitation 

of: 

wherein the first module passes parameters to the at 
least one programmable processing module, thereby changing 
the processing performed by the at least one programmable 
processing module. 

As described above, neither McCreery nor Fleig, alone or in combination, 
disclose the limitations of independent claim 13. 

For these reasons, independent claims 1 and 13 are allowable over the 
cited art. Allowance of these independent claims is requested. 

The remaining claims are dependent upon an allowable independent claim 
and are therefore also allowable. In addition, the dependent claims add 
additional patentable subject matter and are also allowable for the reasons 
discussed below. 

Dependent claims 3 and 15 contain the limitation that the at least one 
programmable processing module is generated from a processing query 
expressed in a high-level language. The Office Action states that McCreary 
discloses the limitations of claims 3 and 15 in col. 7, lines 16-26. In particular, 
McCreary discloses, in col. 7, lines 16-26, that the "internet activity analyzer 300 
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preferably uses a conventional operating system such as MacOS but the artisan 
will recognize that a variety of alternative operating systems may be implemented 
such as Windows or UNIX." McCreary does not, however, disclose a processing 
query that is expressed in a high-level language being used to generate a 
programmable processing module. Therefore, dependent claims 3 and 15 are 
allowable. 

Dependent claims 10 and 22 contain the limitation that the first module 
can instantiate new processing modules dynamically. The Office Action states 
that McCreary discloses this limitation with a data indexing and stripping module 
that manipulates data sets. (Col. 12, lines 60-62). McCreary does not, however, 
disclose instantiating new processing modules. Therefore, dependent claims 10 
and 22 are allowable. 

III. Conclusion 

For the reasons discussed above, all pending claims are allowable over 
the cited art. Reconsideration and allowance of all claims is respectfully 
requested. 
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